Aller au contenu principal

WP-01 API spec

The module is in afia-api. Contract types: contracts.md. Wire: exchange/identity.md.

Usage​

IdentityService.requestOtp(phone) starts a challenge. verifyOtp(phone, code) returns Session. me(session) returns Account. Deletion uses the same Account row. Phone or email identifies the account.

Domain​

  • Account at health.afia.app.identity.Account. Contract Account.
  • Role at health.afia.app.identity.Role. Contract Role.
  • Session at health.afia.app.identity.Session. Contract Session.
  • Consent at health.afia.app.identity.Consent. Contract Consent.

Persistence​

AccountEntity table account. One row per login. Admin does not create a second user table. ConsentEntity table consent when consent lands. Session storage is an implementation choice inside this package. Do not expose it on HTTP.

HTTP DTOs​

  • OtpRequestDto inbound. Field phone.
  • OtpVerifyDto inbound. Fields phone, code.
  • AccountResponseDto outbound. Same fields as contract Account.
  • DeleteAccountDto inbound. phone or email.

JSON lives in the exchange file. Validate on these DTOs.

Mappers​

AccountMapper.toResponse(Account) -> AccountResponseDto
AccountMapper.toDomain(AccountEntity) -> Account
ConsentMapper.toDomain(ConsentEntity) -> Consent

Hand-written. No MapStruct.

Services​

IdentityService
  requestOtp(phone) -> void
  verifyOtp(phone, code) -> Session
  me(session) -> Account
  deleteAccount(session, phoneOrEmail) -> void
  recordConsent(session, purpose) -> Consent

OTP sketch unless a later ADR replaces it.

Controllers​

  • AuthController on reserved /api/v1/afia/auth. POST request and verify.
  • MeController on reserved /api/v1/afia/me. GET current account. Deletion on the same prefix.

Use EndpointUri constants that WP-00 reserved.

Does not do​

Patient, clinician, diagnostics, or admin packages. A second user table. Flutter types. Invented login screens. Spring Security unless an ADR picks it.